picnoir
/
glibc
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

CVE-2022-23218: Buffer overflow in sunrpc svcunix_create (bug 28768) 

The sunrpc function svcunix_create suffers from a stack-based buffer
overflow with overlong pathname arguments.

Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
This commit is contained in:
Florian Weimer 2022-01-17 10:21:34 +01:00
parent ef972a4c50
commit f545ad4928
4 changed files with 50 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
NEWS
View File

@ -160,6 +160,9 @@ Security related changes:
legacy function could result in a stack-based buffer overflow when
using the "unix" protocol. Reported by Martin Sebor.
CVE-2022-23218: Passing an overlong file name to the svcunix_create
legacy function could result in a stack-based buffer overflow.
The following bugs are resolved with this release:
[The release manager will add the list generated by

2
sunrpc/Makefile
View File

@ -65,7 +65,7 @@ shared-only-routines = $(routines)
endif
tests = tst-xdrmem tst-xdrmem2 test-rpcent tst-udp-error tst-udp-timeout \
tst-udp-nonblocking tst-bug22542
tst-udp-nonblocking tst-bug22542 tst-bug28768
xtests := tst-getmyaddr

11
sunrpc/svc_unix.c
View File

@ -154,7 +154,10 @@ svcunix_create (int sock, u_int sendsize, u_int recvsize, char *path)
SVCXPRT *xprt;
struct unix_rendezvous *r;
struct sockaddr_un addr;
socklen_t len = sizeof (struct sockaddr_in);
socklen_t len = sizeof (addr);
if (__sockaddr_un_set (&addr, path) < 0)
return NULL;
if (sock == RPC_ANYSOCK)
{
@ -165,12 +168,6 @@ svcunix_create (int sock, u_int sendsize, u_int recvsize, char *path)
}
madesock = TRUE;
}
memset (&addr, '\0', sizeof (addr));
addr.sun_family = AF_UNIX;
len = strlen (path) + 1;
memcpy (addr.sun_path, path, len);
len += sizeof (addr.sun_family);
__bind (sock, (struct sockaddr *) &addr, len);
if (__getsockname (sock, (struct sockaddr *) &addr, &len) != 0

42
sunrpc/tst-bug28768.c Normal file
View File

@ -0,0 +1,42 @@
/* Test to verify that long path is rejected by svcunix_create (bug 28768).
Copyright (C) 2022 Free Software Foundation, Inc.
This file is part of the GNU C Library.
The GNU C Library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
The GNU C Library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with the GNU C Library; if not, see
<http://www.gnu.org/licenses/>. */
#include <errno.h>
#include <rpc/svc.h>
#include <shlib-compat.h>
#include <string.h>
#include <support/check.h>
/* svcunix_create does not have a default version in linkobj/libc.so. */
compat_symbol_reference (libc, svcunix_create, svcunix_create, GLIBC_2_1);
static int
do_test (void)
{
char pathname[109];
memset (pathname, 'x', sizeof (pathname));
pathname[sizeof (pathname) - 1] = '\0';
errno = 0;
TEST_VERIFY (svcunix_create (RPC_ANYSOCK, 4096, 4096, pathname) == NULL);
TEST_COMPARE (errno, EINVAL);
return 0;
}
#include <support/test-driver.c>